Blog
What we learn building software, written down.
Architecture decisions, Adobe Experience Manager, audits, cloud, and working with distributed teams. Written by the people who do the work, dated and signed.
Recent posts
9 posts shown
Cloud and operations
Critical PHP and Node.js vulnerabilities: what happened, who is affected and what we did.
On October 21, 2026, PHP and Node.js shipped security releases on the same day. PHP fixed two critical flaws that allow code execution on the server without logging in, and Node.js fixed ten, four of them rated high. The only complete protection is to update, to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and to Node.js 26.12.1, 24.22.1 or 22.23.4, and to restart the services. At Editando Ideas we have already updated Node.js in our website and client portal, and confirmed that our clients’ PHP sites run patched versions.
Websites and web platforms
AI, an app, a platform or automation? Five questions to find out what your business needs.
It depends on where you are losing time or customers today. If your team answers the same questions every day or reads long documents to pull out two facts, AI helps; if your customers or field team do something on their phones every week, an app; if the process lives in spreadsheets, emails and chats, a platform; if your website only informs, a site that serves and sells; and if someone repeats the same task every week, automation. It is almost always best to start with just one: the one that hurts most.
Adobe Experience Manager
Content Fragments vs. Experience Fragments: when to use each.
Use Content Fragments when what you reuse is the content itself: structured, design-free data shown on several channels or delivered to an app through an API. Use Experience Fragments when what you reuse is an assembled experience: a group of components with their layout that looks the same on many pages, such as a header, a footer or a promotion. The deciding question is whether the design travels with the content or each channel supplies its own.
Software architecture
Monolith or microservices: when splitting actually pays off.
Microservices are justified when teams need to deploy independently, when parts of the system have very different scaling or availability needs, and when domain boundaries are already stable. If those conditions are not met, a well-modularized monolith is usually faster to build, easier to run, and simpler to split later, once it is really needed.
Technical audits
What a technical audit includes, and what it delivers.
A technical audit reviews the real state of a system —code, architecture, dependencies, security, data, infrastructure, delivery process, and performance— and ends in a document with findings prioritized by impact and effort, plus a remediation plan. It exists to help you decide what to do with a system based on evidence, and it does not commit you to hiring whoever did it for the implementation.
Websites and web platforms
Signs a spreadsheet should no longer run your operation.
A spreadsheet stops being enough when several people depend on it at the same time, when nobody knows which version is right, or when operations stall if the one person who understands it is out. At that point there are three paths —clean up the sheet, adopt an off-the-shelf product, or build a custom platform— and the choice depends on how specific your process is.
Adobe Experience Manager
What to check before migrating an AEM 6.5 project to AEM as a Cloud Service.
Before moving a single page, review five fronts: code compatibility with an immutable repository and current APIs; the size and structure of content and assets; the Dispatcher configuration; integrations and networking; and the cutover plan. Adobe provides tools for most of this assessment, but remediation decisions, and the order in which they happen, still belong to the team.
Websites and web platforms
How we rebuilt editandoideas.com: static, bilingual, and with no inline scripts.
This site is static: every URL is generated as HTML at build time with React Router, and there is no application server and no forms. Everything comes from a single route map —prerendering, hreflang, sitemap, language switcher, and breadcrumbs—, editorial rules are enforced by automated tests, and the content security policy allows no inline scripts. Here is why, and what we would do differently.
About Editando Ideas
Why we started a blog, and what you will find in it.
We are starting an engineering blog to write down what we learn designing, building, and running digital products. We will only write about what we do every day —Adobe Experience Manager, architecture, cloud, technical audits, distributed talent, product, and technical SEO— with the answer first, our own examples, sources, dates, and a named author.
